Privacy Policy

Last updated: October 12, 2026

1. Introduction

This Privacy Policy explains how Rthms, Inc. ("rthms," "we," "our," or "us") collects, uses, shares, and otherwise processes personal information about you.

rthms is a habits and lifestyle application. It reflects your recent activity back to you as scores and insights, turns patterns in that activity into habit tags, and uses those tags to recommend places and events near you, to suggest plans, and to connect you with people and groups. Doing that requires personal information, some of it sensitive. This document sets out exactly what we collect, why, who else sees it, and what control you have.

This Policy applies to the rthms mobile application, the rthms websites at rthmsapp.com and rthms.app including the event sign-up portal, and to our communications with you (together, the "Services").

If you do not agree with the practices described here, do not use the Services.

A note on an earlier version of rthms. rthms previously included dating and matchmaking features. Those features have been discontinued. Some information collected under that earlier product still exists in accounts created at the time. Section 4.7 explains what that is and what we are doing about it.

2. Summary

This is a plain-language summary. It is not a substitute for the rest of the document.

• You choose your data sources. Apple Health, spending habits through Plaid, Apple Music, YouTube, location, and supported wearables are each opt-in, and each can be disconnected.

• We store some raw health data, not only derived summaries. Sleep sessions, workouts, steps, and mindfulness sessions are stored on our servers.

• We never receive your bank credentials, card numbers, transaction amounts, or balances. From a linked financial account we store merchant names, spending categories, and dates.

• We store your precise location as the centre point for recommendations, and a coarse trail of places you have visited.

• We use Google Gemini for AI features. That includes your chat messages, your first name, your city, your habit tags, and, for tag verification, photographs you upload.

• We do not sell your personal information, and we do not share it with data brokers. If you allow tracking in Apple's prompt, we use Google Firebase Analytics to measure which of our Google ads led you to rthms. If you do not allow it, nothing is sent for that purpose. Section 4.9 explains exactly what is involved.

• You can delete your account at any time from Settings. Section 9 explains precisely what that removes and what it does not.

3. How We Obtain Information

We obtain personal information in four ways.

Directly from you. Account registration, your profile, photographs, posts, messages, events and Circles you create, support requests, and anything else you type or upload.

From your device, with your permission. Location, Apple Health data, your Apple Music listening history, photographs you select, and your contact list if you use contact matching. Each of these requires an operating-system permission you grant and can revoke.

From services you connect. Plaid, YouTube, Oura, and WHOOP, each only after you complete that provider's authorization flow.

Automatically, as you use the Services. Device and app information, product analytics events, and the technical records created by serving you. If you allow tracking, Google Firebase Analytics also records app events for advertising measurement, as described in Section 4.9.

We also generate information about you: habit tags, category scores, insights, and recommendations are our own derived observations, not raw inputs.

4. What We Collect

4.1 Account and profile

If you register through Sign in with Apple or Google Sign-In, we receive the identity token that provider issues, which typically includes your name and email address.

4.2 Location

Location is optional, and recommendations are substantially worse without it.

Precise location. When you grant location permission, we record your current coordinates as the centre point used to find places and events near you, and to show you who and what is nearby. We store this coordinate on your profile at the precision the device reports.

Visit detection. If you additionally grant "Always" location permission, iOS notifies the app when you arrive at and leave a place, so that a visit can become a habit tag without you doing anything. rthms does not run in the background to follow you; it has no background-location capability and receives only the visit notifications iOS chooses to deliver. The audit record we keep of these visits stores coordinates rounded to roughly 100 metres. A separate record stores which place and category you visited, with no coordinates at all.

Coarse location. Your typed city is stored as text and is what the AI features see.

You can withdraw location permission at any time in iOS Settings, and turn off visit detection separately in the app.

4.3 Health and wellness

Only if you connect Apple Health, and only for the categories you approve in Apple's own permission sheet, we read and store:

• Sleep, as sessions with start and end times, sleep stage, the recording device or app, and your time zone

• Workouts, as activity type, duration, distance, energy burned, start and end times, and the recording device

• Steps and distance, as daily totals

• Mindfulness sessions, as durations

• Heart rate and heart rate variability

We store raw samples, not only summaries. This is a meaningful difference from a policy that promises only derived labels. The sleep session, the individual workout, and the daily step count are all retained on our servers so that scores and insights can be recomputed and explained to you.

If you connect an Oura ring or a WHOOP band, we store the connection, daily recovery and sleep scores with their component breakdown, and workouts.

The app is also capable of writing data back to Apple Health. It does so only for activity you record in rthms, and only with your permission.

Health data is used to provide and improve health-related and lifestyle features of the Services. It is never used for advertising or marketing, and it is never sold or shared for use-based data mining, by us or by anyone else.

4.4 Financial information

Only if you connect a financial account through Plaid.

What Plaid handles, not us. You enter your financial institution credentials into Plaid's own interface. Those credentials are never transmitted to, seen by, or stored by rthms. The connection is read-only: rthms cannot move money, make payments, or change anything in your accounts.

What we store. The name of the institution, an access token that lets us request updates, and for each linked account its name, type, and the last four digits of its number. For each transaction we store the merchant name, a spending category, and the date.

What we do not store. We do not store transaction amounts, account balances, account numbers beyond the last four digits, statements, or any credential.

4.5 Music and video

If you connect Apple Music, we store the artists and genres you listen to. Artwork is retrieved from Apple's public search service using only an artist or track name.

If you connect YouTube, we store the channels you subscribe to and the videos you have liked, each as an identifier and a date, together with the token that lets us refresh them. We do not store video content, watch history, comments, or anything else from your YouTube account. These records are pruned on a rolling 30-day basis in line with Google's requirements.

4.6 Content you create

Posts and their photographs and videos, comments, likes, direct and group messages, Circles, events, event photographs, Paths, verification photographs, and your conversations with rthms AI. Media is held in access-controlled storage; event photographs and verification photographs are in private buckets.

4.7 Information from the earlier dating product

Accounts created before rthms discontinued its dating features may still contain gender, sexual orientation, relationship preferences, preferred age range, religious affiliation, and a separate dating profile photograph. Nothing in the current app collects, displays, or uses these fields, with one exception: an aggregated, anonymized gender breakdown may be shown to an event organizer.

Religious affiliation and sexual orientation are special categories of personal information. We are retiring these fields. If you want yours deleted now, write to support@rthmsapp.com and we will remove them from your record.

4.8 Contacts

If you choose to find people you know, the app uploads phone numbers and email addresses from your device's contact list to our servers to check which of them already have rthms accounts. This information goes only to rthms and is not shared with any third party. This is optional and you can decline it.

4.9 Device and usage information

Push notification tokens and a device name; app version, operating-system version, and device model; product analytics events describing which screens you opened and which features you used; and the technical logs created by serving your requests, including IP address.

We do not use session recording, and we do not automatically capture the contents of screens or forms.

Advertising measurement, only if you allow tracking. We advertise rthms on Google. To learn which of those ads lead people to install the app and create an account, the app includes Google Firebase Analytics. It stays switched off unless you choose Allow in Apple's App Tracking Transparency prompt. If you allow it, Firebase records automatic app events, such as the first time you open the app, your app sessions and any purchases you make in the app through the App Store, together with basic device and app information and an identifier Firebase creates for this installation of the app. When you create an account, the app also turns your email address or phone number into a one-way code (a SHA-256 hash) on your device, passes that code to Google's on-device conversion measurement, and records a single sign-up event that carries no other details. We never give Google your email address or phone number in readable form. We do not send Firebase your rthms account identifier, your name, or any health, financial, location, message or habit tag data. We do not collect the device advertising identifier (IDFA) or the vendor identifier, and we have turned off the setting that would let Google use this data to personalize ads. If you decline, Firebase collects nothing. If you allow it and later change your mind in iOS Settings, Firebase is switched off the next time you open rthms.

4.10 Subscription information

If you buy a subscription, we receive from Apple, through our subscription management provider, the product purchased, a transaction identifier, and the expiry or renewal date, associated with your account identifier. We never receive your card number.

5. Sensitive Personal Information

The following categories we collect are treated as sensitive under one or more privacy laws:

• Precise geolocation

• Health and wellness data, including sleep, heart rate, and heart rate variability

• Financial account information, being institution and merchant metadata

• Contents of messages you send to other members

• Religious affiliation and sexual orientation, for legacy accounts only, as described in Section 4.7

We use sensitive personal information only to provide the features you have asked for, to keep the Services safe, and to comply with law. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you for advertising, and we do not sell it.

Health data receives specific additional protection. Consistent with Apple's requirements, data obtained from Apple Health is used exclusively to provide and improve health and lifestyle features. It is never used for marketing, advertising, or use-based data mining, including by third parties.

6. Artificial Intelligence

Several rthms features use artificial intelligence. This section describes them precisely, because a general statement would not be enough.

6.1 Who processes the data

All AI processing performed by rthms uses the Google Gemini API, operated by Google LLC, acting as our service provider. rthms does not send your personal information to any other AI provider.

6.2 What is sent, feature by feature

rthms AI, the in-app assistant. When you send a message, we transmit to Gemini: your message; up to six previous turns of your own conversation, each truncated; your first name; your city; up to six habit tag labels; the titles of events you are attending; names of places you saved; titles of recent Paths; the names of your Circles; a count of how many places you went to recently were new; titles of today's picks; and any facts you have explicitly asked rthms AI to remember. Where your request concerns a specific location, the coordinates of that location are included.

Habit tags derived from health data are removed before this is assembled. The names of other members are never included; a friend you mention contributes only an anonymous marker. Your conversation is yours alone, and other members' messages cannot enter it.

Photograph verification. When you verify a habit tag by submitting a receipt, a ticket, or a photograph of an activity, that photograph is transmitted to Gemini to read or classify it. This is image data, not text, and it is your own photograph.

Insights and summaries. Habit tag names, category scores, and weekly series of workout and sleep minutes are sent to Gemini to write the sentences you read in your category summaries and insights.

Spending categorization. Merchant names from a linked financial account are sent to Gemini to classify them into cuisine and spending categories. No amount, date, balance, or account detail is included.

Daily picks. A coarse location, snapped to a grid cell roughly fourteen miles across and shared with everyone else in that cell, is sent to Gemini together with a search tool to find places worth recommending.

Video interests. Where YouTube is connected, channel titles are sent to Gemini to map them to interests.

6.3 What is never sent

We do not send to Gemini: your surname, username, email address, phone number, password, transaction amounts, account balances or numbers, raw heart rate or heart rate variability samples, individual sleep or workout records, your profile photographs except where you submit one for verification, messages you exchange with other members, or another member's name.

6.4 Google's handling

Google processes this data as our service provider under the Gemini API terms. On the paid tier of that API, Google does not use the data to train its models and retains it for a limited period for abuse monitoring. Our AI features are operated on that paid tier.

6.5 Your consent and how to withdraw it

Before rthms AI processes your first message, we ask for your explicit consent, and we show you what will be sent. You can withdraw that consent at any time in Settings, which stops the assistant from sending anything further.

Photograph verification, insight generation, and spending categorization are part of the core features they belong to rather than the assistant, and they are governed by your use of those features. If you do not want a photograph processed, do not submit one for verification.

6.6 AI output is not advice

Insights, summaries, recommendations, compatibility observations, conversation starters, and assistant replies are informational. They are not medical, health, mental health, nutritional, fitness, financial, investment, legal, or psychological advice. They can be wrong. Do not rely on them in place of a qualified professional.

6.7 Connecting rthms to an external AI assistant

rthms offers a connector that lets you link your account to an external AI assistant, such as Claude or ChatGPT, so that it can answer questions using your rthms data.

This is the reverse of the arrangement above: rather than rthms sending data to a model, you authorize a third-party product to read from your account. If you connect one, that assistant can retrieve your display name, your profile photograph, your home area to a precision of roughly one kilometre, your habit tags, and place and event recommendations. One feature can return the first names and shared interests of up to three other members. Once data reaches that assistant it is governed by that company's privacy policy, not ours.

You choose which permissions to grant, you can see them at the point of authorization, and you can revoke the connection at any time from Settings or by asking the assistant to disconnect.

This connector is not yet available in the released app. This section is published in advance so that the disclosure is in place before it is.

7. How We Share Information

7.1 With other members

Your profile, your posts, your Circle activity, and the events you join are visible to other members according to the settings you choose. Anything you share with another member is outside our control once they have it.

7.2 With service providers

We use the following providers. Each processes personal information only to perform a service for us.

Analytics events are filtered before they leave the app so that habit tags and health-derived fields are stripped out. The only event the app itself sends to Firebase is the sign-up event, and it carries no details at all.

7.3 For legal and safety reasons

We disclose personal information where we believe in good faith it is necessary to comply with law or legal process; to enforce our Terms; to detect, prevent, or respond to fraud, abuse, or security incidents; or to protect the rights, property, or safety of rthms, our members, or the public. Where we determine that your use of the Services violates our Terms or the law, or presents a risk to others, we may notify affected members, law enforcement, or regulators.

7.4 What we do not do

We do not sell your personal information. We have not sold personal information in the preceding twelve months.

We have no data broker relationship, and we do not let advertisers target you using your rthms data. The app does include Google Firebase Analytics, which we use only to measure our own Google ad campaigns, and only if you allow tracking in Apple's prompt (Section 4.9). Some laws, including California's, may treat that measurement as "sharing" personal information for cross-context behavioral advertising. You can opt out at any time by declining the prompt, or by turning off Allow Apps to Request to Track, or the switch for rthms, in iOS Settings, Privacy & Security, Tracking.

We do not use health data or the contents of your messages for marketing.

7.5 Business transfers

If rthms is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will give notice before your information becomes subject to a materially different privacy policy.

8. Retention

We keep personal information for as long as your account is active, and afterwards only as described in Section 9 or as required by law. In deciding how long to keep something we consider its sensitivity, the risk of harm from disclosure, whether the purpose can be achieved another way, and our legal obligations.

Specific periods that apply regardless of the above:

We may keep anonymized or aggregated information indefinitely, because it can no longer identify you.

8.1 Disconnecting a source

Disconnecting a data source stops future collection immediately.

Plaid. We revoke the connection with Plaid and delete the institution, its accounts, and their transactions. Habit tags already derived remain, marked as no longer supported by a live source.

YouTube. We revoke our access with Google and delete the connection, the stored token, your subscription records, and your liked-video records.

Apple Health, Apple Music, location. Withdraw the permission in iOS Settings. Ask us at support@rthmsapp.com to delete the data already collected and we will do so.

Habit tags are our own observations rather than source data, so they persist unless you remove them. You can remove any tag from your profile.

9. Deleting Your Account

You can delete your account at any time from Settings. It takes effect immediately and cannot be undone.

9.1 What is deleted

Your login credentials and authentication record; your financial connections, accounts, and transactions; your health, sleep, workout, and wellness records; your conversations and messages; your connections with other members; your push notification tokens; your habit tags and the evidence behind them; your music records; your consent records; your notifications; your stored photographs; and your analytics identity, which we ask our analytics provider to erase along with its associated events.

9.2 What is retained, and why

Your profile record is anonymized rather than deleted. Your name, username, email address, phone number, and photographs are removed from it and it is marked as deleted. The record itself remains so that conversations, Circles, and events involving other members do not break.

Content you posted may remain, attributed to that anonymized profile, because other members may have interacted with it. Comments you left are replaced with a deletion marker.

If you want specific posts or photographs removed, delete them before deleting your account, or write to support@rthmsapp.com and we will remove them.

We also retain what we must for legal compliance, tax, security, fraud prevention, and dispute resolution, and copies persist in encrypted backups for a limited period before being overwritten.

9.3 Deleting without deleting your account

You do not have to delete your account to remove data. You can delete individual posts and photographs, remove habit tags, disconnect any source, and ask us at support@rthmsapp.com to delete any specific category of information.

10. Your Rights and Choices

10.1 Rights

Depending on where you live, you may have the right to: know what personal information we hold and how we use it; access a copy of it; correct it; delete it; receive it in a portable format; opt out of sale, which we do not do, or of sharing for targeted advertising, which you can do at any time as described in Section 7.4; limit the use of sensitive personal information; withdraw consent; object to or restrict certain processing; not be subject to solely automated decisions with legal or similarly significant effects; be free from discrimination for exercising a right; and appeal a refusal.

rthms does not make decisions about you that produce legal or similarly significant effects using solely automated processing.

10.2 Exercising them

Write to support@rthmsapp.com, or to Rthms, Inc., 24662 Del Prado Avenue #1A, Dana Point, CA 92629. Many rights can be exercised directly in the app: your profile is editable, sources are disconnectable, consents are revocable, and your account is deletable, all from Settings.

We will verify your identity before acting, usually by confirming control of the email address or phone number on the account. We acknowledge requests on receipt and respond within the period the applicable law allows, typically 45 days, extendable once with notice. If we cannot act, we will tell you why.

You may use an authorized agent, who must provide your signed written authorization. We may contact you to confirm the authorization.

10.3 Appeals

If we decline your request, you may appeal within 30 days by replying to our response or writing to support@rthmsapp.com with "Privacy Appeal" in the subject line. Include your original request and why you are seeking reconsideration. We will provide a final written determination within 60 days.

10.4 Communication preferences

Unsubscribe from promotional email using the link in any such message. Reply STOP to any text message. Turn off push notifications in Settings or in iOS. Transactional and service messages continue while you hold an account.

10.5 Device permissions

Location, Apple Health, photographs, notifications, contacts, and tracking are each controlled by an iOS permission you can change at any time in Settings. Revoking a permission stops future collection but does not by itself delete what was already collected.

11. Cookies and Similar Technologies

The rthms mobile app does not use cookies. It includes Google Firebase Analytics for measuring our own ad campaigns, which stays off unless you allow tracking (Section 4.9).

The rthms websites use only what is necessary to make them work, including a Cloudflare challenge on the event sign-up page to distinguish people from bots. We do not run advertising cookies or third-party marketing tags on them.

We honor Global Privacy Control signals where they apply. On our websites there is nothing for such a signal to switch off, because they run no advertising cookies or marketing tags. In the app, your choice in Apple's tracking prompt is the control.

The app asks, through Apple's App Tracking Transparency prompt, for permission to measure which of our ads led you to rthms. We do not collect the device advertising identifier either way. Whether you allow or decline, your experience of rthms is the same.

12. Security

We use physical, technical, and organizational safeguards appropriate to the sensitivity of what we hold, including encryption in transit and at rest, row-level access controls in our database, private storage for sensitive media, and restricted internal access.

No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. We maintain procedures for suspected breaches and will notify you and any applicable regulator where we are legally required to do so, within the time the law prescribes.

13. Children

The Services are for adults. They are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We ask for date of birth at registration and prevent registration by anyone who states they are under 18.

If you believe a person under 18 has created an account, contact support@rthmsapp.com. We will investigate and delete the account and its information.

14. International Users

The Services are operated from and hosted in the United States. If you use rthms from outside the United States, your personal information is transferred to and processed in the United States, where data protection law may differ from that of your own country. By using the Services you consent to that transfer.

15. Changes to This Policy

We may update this Policy. When we do, we will change the date at the top. For material changes affecting your rights or how we use your personal information, we will give you additional notice, by email, in-app notice, or a prominent notice on our website, and where the law requires it we will obtain your consent. Your continued use after a change takes effect constitutes acceptance of it.

16. California Privacy Rights

This section supplements the rest of this Policy for California residents.

16.1 Categories collected and disclosed

In the preceding twelve months we have collected the following categories. We have not sold any category. From October 2026, if you allow tracking in Apple's prompt, we disclose identifiers (an app installation identifier and a one-way hash of your email address or phone number) and internet or network activity (app events such as first open, app sessions, App Store purchases and sign-up) to Google for measuring our ad campaigns. This may be "sharing" for cross-context behavioral advertising under California law. Section 7.4 explains how to opt out.

Sources, purposes, and recipients for each are described in Sections 3 through 7. Identifiers and internet or network activity are also disclosed to Google for advertising measurement if you allow tracking, as described above.

16.2 Sensitive personal information

We use sensitive personal information only to provide the features you requested, to secure the Services, and to comply with law. Because we do not use it to infer characteristics about you, the right to limit its use under § 1798.121 does not apply, but you may still disconnect any source or delete your account.

16.3 Retention

We do not keep personal information longer than reasonably necessary for the purposes in this Policy. Section 8 sets out the periods that apply.

16.4 Notice regarding text messages

Mobile information and consent to receive text messages are never shared with third parties or affiliates for their own marketing or promotional purposes.

16.5 Exercising California rights

Use the methods in Section 10.2. To opt out of sharing, decline tracking in Apple's prompt, or turn it off in iOS Settings, Privacy & Security, Tracking. We will not discriminate against you for exercising a right.

17. Contact

Rthms, Inc.
24662 Del Prado Avenue #1A
Dana Point, CA 92629

Email: support@rthmsapp.com

For privacy requests, write to support@rthmsapp.com with "Privacy Request" in the subject line.